chromium/third_party/blink/web_tests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html

<p>Passes if it doesn't crash.</p>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
doc = document.implementation.createHTMLDocument();
var iframe = doc.createElement('iframe');
delete doc;
mouseEvent = document.createEvent('MouseEvents');
mouseEvent.initMouseEvent('click', true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
iframe.dispatchEvent(mouseEvent);
document.documentElement.appendChild(iframe);
gc();
mouseEvent.path;
</script>